https://community.splunk.com/t5/Getting-Data-In/Time-series-visualization-on-top-count/m-p/314133#M58817 <P>Like this?</P> <PRE><CODE>index=apache_web sourcetype=apache_hots host=abc | timechart dc(report_ID) </CODE></PRE> <P>Or maybe this?</P> <PRE><CODE>index=apache_web sourcetype=apache_hots host=abc | timechart count by report_ID </CODE></PRE> Tue, 28 Nov 2017 21:38:52 GMT woodcock 2017-11-28T21:38:52Z https://community.splunk.com/t5/Getting-Data-In/Time-series-visualization-on-top-count/m-p/314132#M58816 <P>Hi,</P> <P>Below is the search I am using to find the report_ID values that have top count.</P> <P><STRONG>index=apache_web sourcetype=apache_hots host=abc | stats count by report_ID</STRONG></P> <P>Below is the output of the above query.</P> <PRE><CODE>report_ID count 17615 25 12344 4 12435 2 11084 6 12181 9 13314 3 13945 2 13955 2 </CODE></PRE> <P>But i would like to see the visuali zation that shows when the report_ID occurred. For example, if the report_ID 17615 has 25 count but i would like to see time series visualization.</P> Tue, 29 Sep 2020 17:01:57 GMT https://community.splunk.com/t5/Getting-Data-In/Time-series-visualization-on-top-count/m-p/314132#M58816 kteng2024 2020-09-29T17:01:57Z https://community.splunk.com/t5/Getting-Data-In/Time-series-visualization-on-top-count/m-p/314133#M58817 <P>Like this?</P> <PRE><CODE>index=apache_web sourcetype=apache_hots host=abc | timechart dc(report_ID) </CODE></PRE> <P>Or maybe this?</P> <PRE><CODE>index=apache_web sourcetype=apache_hots host=abc | timechart count by report_ID </CODE></PRE> Tue, 28 Nov 2017 21:38:52 GMT https://community.splunk.com/t5/Getting-Data-In/Time-series-visualization-on-top-count/m-p/314133#M58817 woodcock 2017-11-28T21:38:52Z